Thought Leadership

AI agents can be weaponized against each other using prompt injections via a chain of flaws in Google's open source Agent Development Kit (ADK) for Python, potentially disrupting the software supply chain and demonstrating yet another new attack vector introduced by the emerging technology.

Researchers from Pillar Security discovered the flaws, present in the ADK's adk-python repository, which allowed a low-privileged, public-facing agent in a workflow to trigger commands that could be executed by a high-privileged one, according a report published on Aug. 4. This means that potentially malicious, untrusted text — such as a pull request or issue — could be performed by a trusted AI agent with repository privileges.

"Pillar Security researchers have identified the first practical, real-world case of agent-to-agent exploitation in a multi-agent system in a real production environment, a class of attack not seen in real production systems until now," Dan Lisichkin, cybersecurity researcher for Pillar, wrote in the report this week.

The attack was especially problematic because it relied on prompt injections embedded in GitHub pull requests to exploit a trust boundary between two AI agents with different privilege levels, according to Pillar. In their proof-of-concept (PoC) exploit, the researchers showed that a public-facing AI agent reviewing pull requests could be manipulated into triggering a maintainer-only AI agent capable of performing privileged actions.

This created a pathway to approve or execute malicious code in continuous integration (CI)/continuous delivery (CD) workflows that affect the development process and thus the software supply chain, Lisichkin said. This scenario, in which one AI agent can be used to attack another, turned "a benign automation into a path that ends in a potential software supply chain compromise," he wrote.

Attack Flow and Remediation

Google's ADK for Python has been downloaded more than 90 million times and is widely used by developers who work with Gemini, Google's large language model (LLM). Pillar credited Google for a prompt response to the flaws, which were reported in early June and remediated on July 9 and July 21, respectively.

Google did not immediately respond to requests for comment by Dark Reading today.

Specifically, the researchers showed that a malicious embedded prompt could persuade the agent to publish a specially formatted @gemini-cli command, according to the report. "That comment was then recognized by a dispatcher workflow and routed to a more privileged Gemini-based automation," Lisichkin wrote.

The finding demonstrates how interactions between AI agents are now emerging as a new privilege-escalation attack surface. Pillar's discovery comes hot on the heels of the emergence of autonomous LLM attacks, introducing yet another threat type against which defenders need to secure AI agents and systems.

While the flaws were characterized as a prompt injection issue — a common attack vector for LLMs and AI agents — the real issue it created for how organizations are using AI agents "is delegation," says Ryan McCurdy, vice president of marketing at database governance firm Liquibase.

“Enterprises are starting to put multiple AI agents into software delivery with different tools, permissions, and levels of authority," he says. "This research shows why governing each agent independently isn't enough. Organizations also have to understand what one agent can cause another agent to do."

The flaws demonstrated a new security consideration for enterprises when developing AI agent behavior, McCurdy says, because "a low-privileged agent shouldn't be able to use a higher-privileged agent to get around controls it couldn't bypass on its own."

Securing Agents Going Forward

The bigger takeaway from the discovery of the flaws is that AI agents are changing some of the assumptions security teams have relied on for years, Pillar's Lisichkin said. In the past, a system was generally considered safe if only trusted or privileged users could reach it. But an AI agent that reads untrusted content and has access to credentials can become a bridge into more sensitive systems.

"The compromise lived in the seams, in one agent's ability to reach across a privilege boundary and set another in motion, and in the gap between what each permission looks like it can do and what it can actually do when an adversary chains it with the others," he wrote. "Threat models built around individual components miss this entirely. The edges between agents, the delegation, the impersonation, the triggering, are now first-class parts of the attack surface and have to be modeled as such."

For CISOs and security teams, this means they first must understand where agentic workflows are already operating — especially those that process untrusted content such as pull requests, issues, tickets, emails, or support chats while also holding credentials, Lisichkin said.

To create better defenses, organizations should assume that these agents can potentially be influenced by attackers and constrict their tools and permissions, provide their own identities, and limit their scopes rather than give them broad access tied to human accounts or long-lived credentials, he said. Lisichkin added that organizations also should ensure a lower-privileged agent cannot activate a more privileged one without an authorization check that can't be faked by a prompt injection.